Report · SecurityWeekAbout CVE-2025-55182Published 8 Dec 2025

Exploitation of React2Shell Surges

Source SecurityWeek

Authoritative record:CVE-2025-55182· Critical 10.0

Exploited in the wild · KEV due 12 Dec 2025 · public exploit available (Metasploit, Exploit-DB) : apply the vendor's fix or mitigations to react-server-dom-webpack now.

Data as of 26 Oct 2026, 08:30 UTC

CVSS 3.1 base score

10.0Critical

How severe the flaw is on the 0–10 CVSS scale.

KEV deadline: 12 Dec 2025 US federal agencies must patch by this date; a sensible deadline for everyone else.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Exploitation evidence

t = 0 is the CVE’s publication on cve.org

Disclosed: evidence found.
CVE published 3 Dec 2025
Detectable: evidence found.
nuclei template: React Server Components - Remote Code Execution
Weaponised: evidence found.
1 Metasploit module · 1 Exploit-DB entry, 127 days after disclosure
Exploited in the wildExploited: evidence found.
Listed in CISA KEV 2 days after disclosure
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

CVE ID reserved
by Meta Platforms, Inc.
8 Aug 202518:21 UTC, 117 days before disclosure
CVE published
on cve.org
3 Dec 202515:40 UTC, t = 0
In Threat Radar
record ingested
3 Dec 202515:54 UTC, 14 minutes after disclosure
Added to CISA KEV (opens in a new tab)
exploitation confirmed · ransomware use known
5 Dec 2025, 2 days after disclosure
KEV remediation due
US federal deadline
12 Dec 2025, 9 days after disclosure
First Exploit-DB entry (opens in a new tab)
React Server 19.2.0 - Remote Code Execution
9 Apr 2026, 127 days after disclosure

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), CISA KEV (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Affected software

Product	Affected	Fixed in
Metareact-server-dom-webpack	Affected >=19.0.0 <=19.0.0 >=19.1.0 <=19.1.1 >=19.2.0 <=19.2.0	Fixed in–
Metareact-server-dom-turbopack	Affected >=19.0.0 <=19.0.0 >=19.1.0 <=19.1.1 >=19.2.0 <=19.2.0	Fixed in–
Metareact-server-dom-parcel	Affected >=19.0.0 <=19.0.0 >=19.1.0 <=19.1.1 >=19.2.0 <=19.2.0	Fixed in–
npmreact-server-dom-parcel`pkg:npm/react-server-dom-parcel`Other threats	Affected =19.0.0 =19.1.0 =19.1.1 =19.2.0	Fixed in–
npmreact-server-dom-turbopack`pkg:npm/react-server-dom-turbopack`Other threats	Affected =19.0.0 =19.1.0 =19.1.1 =19.2.0	Fixed in–
npmreact-server-dom-webpack`pkg:npm/react-server-dom-webpack`Other threats	Affected =19.0.0 =19.1.0 =19.1.1 =19.2.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

AI-suggested

European organizations should implement a multi-layered mitigation strategy. First, monitor official React project channels and security advisories closely to apply patches immediately once available. Until patches are released, conduct thorough code audits focusing on input handling and component rendering logic to identify and remediate vulnerable patterns. Employ strict input validation and sanitization to prevent injection of malicious payloads. Deploy Web Application Firewalls (WAFs) with updated rules to detect and block exploitation attempts targeting React2Shell. Enhance logging and monitoring of web application behavior to identify anomalous activities indicative of exploitation. Educate development teams about secure coding practices specific to React and the nature of this vulnerability. Consider isolating critical React applications in segmented network zones to limit potential lateral movement. Finally, prepare incident response plans tailored to web application compromises involving React vulnerabilities to ensure rapid containment and remediation.

Description

An increasing number of threat actors have been attempting to exploit the React vulnerability CVE-2025-55182 in their attacks. The post Exploitation of React2Shell Surges appeared first on SecurityWeek .

Impact

For European organizations, the React2Shell vulnerability presents a risk of unauthorized code execution within web applications, potentially leading to data breaches, service disruption, and loss of user trust. Industries with heavy reliance on web applications, such as finance, e-commerce, healthcare, and government services, could face targeted attacks aiming to exploit this flaw. The compromise of React-based applications could allow attackers to steal sensitive information, manipulate application behavior, or use the compromised environment as a foothold for lateral movement within corporate networks. Given the interconnected nature of European digital infrastructure and regulatory requirements like GDPR, exploitation could result in significant legal and financial consequences. The medium severity rating suggests that while exploitation is not trivial, the widespread use of React increases the attack surface. Organizations with insufficient patch management or lacking runtime application self-protection may be particularly vulnerable. The surge in exploitation attempts also raises the likelihood of automated attacks, increasing the volume and speed of potential compromises.

Summary

The React2Shell vulnerability, identified as CVE-2025-55182, is a security flaw in the React JavaScript library that allows attackers to execute arbitrary code within affected applications. React is a dominant front-end framework used globally to build interactive web interfaces. The surge in exploitation attempts indicates that multiple threat actors are actively scanning and attempting to leverage this vulnerability to compromise systems. Although no confirmed exploits in the wild have been reported, the increased activity suggests that exploitation techniques may soon mature or are being tested. The vulnerability likely arises from improper handling of certain inputs or components within React, enabling attackers to inject malicious payloads that execute in the context of the application or user environment. This can lead to unauthorized access, data theft, or further network compromise. The medium severity rating reflects that exploitation requires some conditions to be met, such as specific application configurations or user interactions, but the impact on confidentiality and integrity can be significant. The lack of available patches at the time of reporting means organizations must rely on interim controls such as code reviews, input validation, and enhanced monitoring. Given React's widespread adoption in enterprise and consumer-facing applications, the vulnerability poses a substantial risk to web applications globally, including those operated by European organizations.

Public tooling indexed from Metasploit Framework, Exploit-DB and ProjectDiscovery nuclei-templates. Its existence raises the odds of exploitation; it does not confirm attacks.

References

securityweek.com/exploitation-of-react2shell-surges/ (opens in a new tab)

Community reviews

Loading reviews…

Exploitation evidence

Timeline

What to do

Affected software

Description

AI analysisMachine-generated, updated 8 Dec 2025, 09:45 UTC

Public exploits and detection1 Metasploit module, 1 Exploit-DB entry, a Nuclei detection template

References

Community reviews

Related threats